Systems and methods for ransomware detection and mitigation

Abstract

System and method for protecting a computing device of a target system against ransomware attacks employs a file system having a data structure used by an operating system of the computing device for managing files. A software or a hardware installed agent in the computing device performs one or more actions autonomously on behalf of the target system. The agent autonomously creates one or more trap files in the data structure of the filing system. A trap file is a file access to which indicates a probability of ransomware attack. The agent monitors access to the one or more trap files. Upon detecting access to a trap file, remedial action is performed by the target system against the probability of ransomware attack.

Description

BACKGROUNDTechnical Field[0001]The present disclosure relates generally to cybersecurity technology. More specifically, the present disclosure relates to systems and methods for ransomware detection and mitigation.Related Art[0002]In the cybersecurity field, ransomware is malware which denies a victim access to data or equipment until an attacker allows access to be returned. Typically, access is denied due to the attacker encrypting the victim's data, and decryption capability is provided after the victim pays the ransom. Defensive and attacker ransomware-focused capabilities have matured in capability and complexity of encryption capability, scope of resources denied, and payment methodologies.[0003]Regarding encryption capability, encryption algorithms have grown in quality to the standardized encryption algorithms and implementations seen in use today for regulated and secure government, military, and commercial uses. The quality of an encryption algorithm is assessed based on t...

AI Technical Summary

Benefits of technology

[0021]According to other details of the present invention, the remedial action includes notifying a user of the target system or automatically uploading an accessed trap file.

Problems solved by technology

Discovered logic fallacies which may have reduced naive decryption to still-longer-than-lifetimes (for example) timeframes, over time become threats resulting in decryption in much shorter times due to improvements in computing power.

For ransomware authors, this means that encryption operations, improperly conducted, may result in opportunities for advanced cybersecurity defenders to exploit those vulnerabilities to decrypt without paying the ransom, even if the encryption algorithm used is strong.

This included predictable cryptovariables, such as encryption keys that are not created via proper randomization (an encryption key of all zeroes, for example), improper cryptovariable reuse, and improper implementation of encryption algorithms.

Additionally, automated spreading of ransomware malware from device to device may result in additional connected victims not related to the origina

Images